I am designing some python software application that configures custom hardware. Since the application requires specific hardware peripherals and an exotic network configuration, it makes sense to package it on a purpose-built appliance.
The software application works on any unix-like environment with python3 available, so OpenBSD and Debian are both candidates; both support my hardware platform and both receive security updates. Debian can be pared down to a minimal install to harden it, and OpenBSD has proactive security features like pledge() that could be integrated into the application code. Either way, I'm mostly looking for a not-insecure OS that can run some python code.
While OpenBSD's security is venerable, debian stands out in software packaging software. Building a .deb, signing it with a GPG key, and installing/removing it is covered by numerous tutorials. On debian, `apt-get' can install this package, and later remove every file.
But figuring out the ideal way to make an equivalent package for OpenBSD has been less straightforward. The ports tutorial says all ports need to be built with X-windows running on the build machine. Does that still apply to python3 code? What if I have a compiled utility to add to the package later? There is a man page for 'pkg_create' but there's hardly any tutorials that reference it or how to use it.
On freenode, #openbsd has been full of incredulous, unhelpful tips like "why would you use a package manager when you could just untar an archive onto root to install your application?"
As much as I respect the OpenBSD team, it's frustrating when you try to perform what should be a straightforward task but google and IRC make you feel like you're the first person who's ever tried it.